Should I remove “Trojan.Win32.Bublik.bzhe”?

The Trojan.Win32.Bublik.bzhe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Bublik.bzhe virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Created a process from a suspicious location
• Attempts to modify proxy settings
• Anomalous binary characteristics

How to determine Trojan.Win32.Bublik.bzhe?

File Info:
name: 1AB2BAE9B7F6BD45D5A7.mlw
path: /opt/CAPEv2/storage/binaries/807fc0d9d9f0c2b39e22dd4830396b9d5778561fb94e143ed5e73250845939ef
crc32: 963C5AEB
md5: 1ab2bae9b7f6bd45d5a7dcab93fad402
sha1: d6580e075f93b1216ebba750e5aec0d9ac604d94
sha256: 807fc0d9d9f0c2b39e22dd4830396b9d5778561fb94e143ed5e73250845939ef
sha512: dec9efc0983d99d43717b05901ce29daf28574b500fbeb3a5b909e023659d42f07ca47ff0e1cf117ea96703fcfe6fb9f7992b4b61676de356e609430f9798ca2
ssdeep: 384:nZOd1djpW9s3mjHXRrs905INeZCFtejlIko5dN127BFVn2p4lAnZ8OJWYB+tnIOk:19djHXRrs9sINeZEtejlIkoLN127BFVM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T115926F38BEC458EAE47392F3F8B6A5C2A9167D867126480E14D33E554DF3B4378A180F
sha3_384: dd12462575f770bb8ee75b33b3c4454d21c81a59eb1aef38ffe0b9d1fdebfef69fb3aa9ca5676451e0e639204b57e895
ep_bytes: b80100000033f656ff151c204000a374
timestamp: 2013-04-06 19:58:07

Version Info:
0: [No Data]

Trojan.Win32.Bublik.bzhe also known as:

How to remove Trojan.Win32.Bublik.bzhe?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.